@cruxy/cli 1.0.3 → 1.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cruxy/cli",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "an agentic coding CLI",
   "type": "module",
   "bin": {
@@ -36,7 +36,7 @@
     "undici": "^6.21.0",
     "zod": "^3.23.8",
     "zod-to-json-schema": "^3.23.5",
-    "@cruxy/sdk": "0.2.1"
+    "@cruxy/sdk": "0.2.2"
   },
   "optionalDependencies": {
     "better-sqlite3": "^12.11.1"

package/dist/agent/budget.d.ts

@@ -1,52 +0,0 @@
-import type { Usage } from "@cruxy/sdk";
-import type { LoopBudget } from "./loop.js";
-/**
- * The live budget primitive for the agent loop: iteration + token + optional
- * wall-clock caps, checked by {@link runAgent} before every model turn (see
- * `LoopBudget`). A tripped cap stops the run with a human-readable reason and
- * the coherent partial history — the loop never runs unbounded.
- *
- * It lives beside the loop it guards: the loop defines the `LoopBudget` seam,
- * this is its one concrete implementation, and the subagent orchestrator, the
- * job manager, and {@link Session} (per-turn token guard) all consume it.
- */
-/**
- * Hard caps a run executes under. `maxTokens` is always finite; `maxIterations`
- * is finite for a subagent (bounded by construction) but may be
- * `Number.POSITIVE_INFINITY` for a token-only guard where iteration count is
- * bounded elsewhere (a main turn is already capped by `agent.maxIterations` in
- * the loop). `timeoutMs` is an optional wall-clock backstop on top.
- */
-export interface BudgetLimits {
-    /** Cap on the run's model turns (may be `Infinity` for a token-only guard). */
-    maxIterations: number;
-    /** Cap on the run's combined input+output tokens. */
-    maxTokens: number;
-    /** Optional wall-clock cap in milliseconds. */
-    timeoutMs?: number;
-}
-/**
- * Resolve the effective limits for one spawn: start from the configured
- * ceilings and let overrides only *narrow* them. A request above a ceiling is
- * clamped down, not honored — "budget overrides within limits" by construction.
- */
-export declare function resolveBudget(defaults: BudgetLimits, overrides?: Partial<BudgetLimits>): BudgetLimits;
-/**
- * A live budget for one run. The wall clock starts at construction (spawn /
- * turn start); the clock source is injectable so tests never sleep.
- */
-export declare class Budget implements LoopBudget {
-    private readonly limits;
-    private readonly now;
-    private readonly startedAt;
-    constructor(limits: BudgetLimits, now?: () => number);
-    /**
-     * The reason to stop before the next model turn, or `null` to continue.
-     * Checked at iteration boundaries — the in-flight turn always completes, so
-     * overshoot is bounded by one turn.
-     */
-    exceeded(state: {
-        iterations: number;
-        usage: Usage;
-    }): string | null;
-}

package/dist/agent/index.d.ts

@@ -1,3 +0,0 @@
-export * from "./loop.js";
-export * from "./session.js";
-export * from "./prompts.js";

package/dist/agent/loop.d.ts

@@ -1,159 +0,0 @@
-import type { Message, Provider, Usage } from "@cruxy/sdk";
-import type { CruxyConfig } from "../config/index.js";
-import type { HookEvent } from "../hooks/index.js";
-import type { StreamRenderer } from "../render/index.js";
-import { type Router, type TaskClass } from "../routing/index.js";
-import type { ToolContext } from "../tools/index.js";
-import { ToolRegistry } from "../tools/index.js";
-/** Optional per-fire context (C.26 step 5). For tool-scoped events the loop
- * passes the raw tool-call `input` so a multi-root {@link HookRouter} can resolve
- * the ONE acting root and fire only that root's hooks. Session lifecycle events
- * (`before-run`/`after-run`) carry no hint — they have no acting root and fan
- * every trusted root. Ignored by the single-root runner. */
-export interface HookFireHint {
-    input?: unknown;
-}
-/** The lifecycle-hook firing seam (C.19). Structural so the loop stays
- * decoupled from the concrete `HookRunner`. `fire` resolves when hooks pass (or
- * advisory ones fail) and throws `CRUXY_E_HOOK_FAILED` on a blocking failure. */
-export interface LifecycleHookRunner {
-    fire(event: HookEvent, ctx: ToolContext, hint?: HookFireHint): Promise<void>;
-}
-export interface RunAgentArgs {
-    /**
-     * The full running conversation. The caller owns history and must append the
-     * user turn before calling; `runAgent` does not fabricate the initial array.
-     */
-    messages: Message[];
-    /** A constructed provider to stream from. */
-    provider: Provider;
-    /** The tool catalogue advertised to the model and dispatched against. */
-    registry: ToolRegistry;
-    /** Resolved CLI configuration (turn ceiling, etc.). */
-    config: CruxyConfig;
-    /** Ambient capabilities handed to each tool. */
-    ctx: ToolContext;
-    /**
-     * The render seam (U.2): assistant text streams through `renderer.write`
-     * delta by delta (each non-empty segment closed via `endSegment`), and
-     * tool-call progress is surfaced as transient `status` + committed `note`
-     * lines. When omitted, behavior is unchanged (one buffered print per turn,
-     * no tool-call chrome). The loop never touches stdout directly.
-     */
-    renderer?: StreamRenderer;
-    /** Git context (branch + dirty) for the system prompt's Environment section. */
-    git?: {
-        branch: string;
-        dirty: boolean;
-    } | null;
-    /** Project instructions (e.g. from CRUXY.md) folded into the system prompt. */
-    projectInstructions?: string | null;
-    /** Persistent memory (C.29): the pre-rendered recall block for the system
-     * prompt, or null. Reference data only — never influences the U.3 gate. */
-    recalledMemory?: string | null;
-    /** Plan mode's propose phase (C.31): inject the plan-first system directive. */
-    planMode?: boolean;
-    /** Subagent runs (C.14): inject the bounded-subtask system directive. */
-    subagent?: boolean;
-    /**
-     * Optional hard budget (C.14): checked before every model turn; a non-null
-     * reason stops the loop with `stop: "budget"` and the partial history. The
-     * in-flight turn (model call + its tool executions) always completes, so
-     * histories stay coherent — overshoot is bounded by one turn.
-     */
-    budget?: LoopBudget;
-    /**
-     * Lifecycle hooks (C.19). When set, `before-tool` fires before each tool call
-     * (a blocking failure fails the call closed — the tool does NOT run), and
-     * `after-tool` / `on-file-change` fire after. Omitted for subagents and the
-     * no-hooks path, so their tools never fire hooks.
-     */
-    hooks?: LifecycleHookRunner;
-    /**
-     * Multi-model routing (C.30): when set, the tier for `taskClass` is resolved
-     * ONCE up front (fail loud before any model turn) and its wire model overrides
-     * the provider default for every turn in this run; the tier is surfaced on the
-     * live line. Omitted → no override, the provider's default model is used
-     * (unchanged behavior).
-     */
-    router?: Router;
-    /** The declared task class for routing; defaults to `main-turn`. Ignored
-     * unless `router` is set. */
-    taskClass?: TaskClass;
-    /**
-     * Usage telemetry (C.22): fired ONCE per completed model request with the
-     * routing tier (C.30) and the provider's usage for THAT request — or
-     * `usage: undefined` when the provider emitted no usage event, so the caller
-     * records it as unknown (never a fabricated zero). LOCAL accounting only:
-     * this is a callback into the process, nothing is transmitted. Omitted → no
-     * collection, behavior unchanged.
-     */
-    onRequestUsage?: (req: {
-        tier?: string;
-        usage?: Usage;
-    }) => void;
-    /**
-     * Cooperative cancellation (C.33). When the signal aborts, the loop stops at
-     * the NEXT turn boundary and returns `stop: "aborted"` with the coherent
-     * partial history — the in-flight turn (model call + its tool executions)
-     * always completes first, exactly like a tripped {@link budget}, so overshoot
-     * is bounded by one turn. Used by the parallel orchestrator to cancel sibling
-     * subagents on a fatal failure or Ctrl-C; omitted → no cancellation (unchanged).
-     * The same signal reaches tools via `ctx.signal`, so an in-flight shell child
-     * is kill-tree'd rather than orphaned.
-     */
-    signal?: AbortSignal;
-    /**
-     * Mid-loop compaction seam (build item 3). Called at the top of every
-     * iteration with the running history; returns the history to continue from —
-     * unchanged when under threshold, or with its older prefix summarized away
-     * when over. Supplied by {@link Session}, which reuses its own
-     * threshold/cut/summarize machinery, so the loop gains no summarization
-     * knowledge and no logic is duplicated. Omitted → history is never compacted
-     * mid-loop (unchanged behavior; subagents pass nothing).
-     *
-     * This is what keeps a long autonomous turn — where `send` compacts only once
-     * up front and never again — within the context window: without it a run that
-     * drives dozens of tool calls (each result appended, some tens of KB) grows
-     * unbounded until the next `send`, which in one-shot never comes.
-     */
-    compact?: (messages: Message[]) => Promise<Message[]>;
-}
-/**
- * The budget seam for {@link runAgent}: implementations track their own caps
- * (iterations, tokens, wall clock — see `subagent/budget.ts`); the loop only
- * asks "may I start another turn?". Kept a one-method interface so future
- * callers (C.22 cost tracking) can slot in without touching the loop again.
- */
-export interface LoopBudget {
-    /**
-     * Return a human-readable reason to stop *before* the next model turn, or
-     * `null` to continue. `iterations` = model turns completed so far.
-     */
-    exceeded(state: {
-        iterations: number;
-        usage: Usage;
-    }): string | null;
-}
-export interface AgentResult {
-    /** The full conversation, including assistant tool calls and tool results. */
-    messages: Message[];
-    /** Number of model turns consumed. */
-    iterations: number;
-    /** Why the loop ended. */
-    stop: "completed" | "max_iterations" | "budget" | "aborted";
-    /** Which cap tripped, when `stop === "budget"` (from {@link LoopBudget}). */
-    stopReason?: string;
-    /** Accumulated token usage (stashed for cost tracking in C.22). */
-    usage: Usage;
-}
-/**
- * Drive the model/tool loop over an existing conversation. Streams each turn,
- * renders assistant text, reassembles tool calls, executes them, feeds the
- * results back, and repeats until the model stops calling tools or the turn
- * ceiling is hit.
- *
- * Requires a tool-capable provider — it throws up front otherwise rather than
- * silently running tool-less.
- */
-export declare function runAgent(args: RunAgentArgs): Promise<AgentResult>;

package/dist/agent/prompts.d.ts

@@ -1,69 +0,0 @@
-/**
- * cruxy-code agent prompts.
- *
- * These are ORIGINAL prompts written for cruxy — not copied from any other
- * tool. The system prompt is assembled at runtime from a static core plus a
- * dynamic environment block, so the model always knows where it is, what it
- * can do, and how it's expected to behave.
- */
-import type { ShellDialect } from "../tools/shell/resolve-shell.js";
-export interface ToolSummary {
-    name: string;
-}
-export interface PromptContext {
-    /** Absolute working directory the agent is rooted in. */
-    cwd: string;
-    /** node `process.platform`, e.g. "linux", "darwin", "win32". */
-    platform: string;
-    /** Provider/model string, for the model's self-awareness. */
-    model: string;
-    /** Current ISO date (so the model isn't guessing). */
-    date: string;
-    /** Tools available this session (from the tool registry). */
-    tools: ToolSummary[];
-    /** Optional git context, when the cwd is a repo. */
-    git?: {
-        branch: string;
-        dirty: boolean;
-    } | null;
-    /** Optional extra instructions (e.g. from a project CRUXY.md). */
-    projectInstructions?: string | null;
-    /**
-     * Persistent memory (C.29): the pre-rendered, demarcated recall block injected
-     * at session start. It is REFERENCE DATA, not instructions — the block carries
-     * its own data-only framing (see memory/recall.ts) and is appended as an
-     * ordinary section; the U.3 gate never reads it. Null when nothing is recalled.
-     */
-    recalledMemory?: string | null;
-    /** Plan mode's propose phase (C.31): inject the plan-first directive. */
-    planMode?: boolean;
-    /** Subagent run (C.14): inject the bounded-subtask directive. */
-    subagent?: boolean;
-    /**
-     * The resolved shell's command dialect (from resolve-shell.ts). When it is not
-     * a POSIX shell — e.g. PowerShell, because no Git Bash was found on Windows —
-     * a directive tells the model to emit that dialect instead of bash. Absent /
-     * "posix" → no directive (bash-isms are correct there; a nudge would be wrong).
-     */
-    shellDialect?: ShellDialect;
-}
-/** Assemble the full system prompt for a session. */
-export declare function buildSystemPrompt(ctx: PromptContext): string;
-/**
- * Compact reminder injected after tool results when the loop has run long, to
- * keep the model anchored to the original objective and the verify step.
- */
-export declare const PROGRESS_REMINDER = "Reminder: stay focused on the original task. Before declaring done, verify your change actually works (build/tests/lint), then summarize what changed.";
-/**
- * System prompt for the side conversation that compacts an over-long history
- * (see Session.compact). It runs as a standalone, tool-less completion over a
- * rendered transcript — the goal is a synopsis dense enough that the main loop
- * can continue without the verbatim prefix.
- */
-export declare const SUMMARY_SYSTEM = "You are compacting a coding assistant's conversation to fit within its context window. Summarize the conversation so far into a compact synopsis that preserves: decisions made and their rationale, concrete file paths and identifiers touched, the current state of the work, and any open or pending tasks. Be specific and terse \u2014 omit pleasantries and restated instructions. Output only the synopsis.";
-/**
- * Marker embedded in the synthetic messages that replace a compacted prefix, so
- * they're recognizable in the history (and fold cleanly into a later
- * re-summarization rather than being mistaken for live conversation).
- */
-export declare const COMPACTION_MARKER = "[conversation compacted]";

package/dist/agent/session.d.ts

@@ -1,212 +0,0 @@
-import type { Message, Provider, Usage } from "@cruxy/sdk";
-import type { CruxyConfig } from "../config/index.js";
-import type { StreamRenderer } from "../render/index.js";
-import { type Router } from "../routing/index.js";
-import type { ToolContext } from "../tools/index.js";
-import type { ToolRegistry } from "../tools/index.js";
-import type { JobManager } from "../jobs/index.js";
-import { type RequestUsage, type UsageRecord } from "../usage/index.js";
-import { type AgentResult, type LifecycleHookRunner } from "./loop.js";
-/**
- * Plan-mode turn runner (C.31), injected so the agent package doesn't depend on
- * the plan package. When plan mode is on, `send` delegates the whole turn to
- * this instead of a single `runAgent` call. Receives the running history (with
- * the user turn already appended) and returns the extended history to adopt.
- */
-export type PlanRunner = (args: {
-    messages: Message[];
-    projectInstructions: string | null;
-    recalledMemory: string | null;
-    renderer?: StreamRenderer;
-    /** Usage telemetry (C.22): forwarded to every model request the plan-mode
-     * turn drives (propose + each execution step), so plan runs are attributed
-     * exactly like a normal turn. */
-    onRequestUsage?: (req: RequestUsage) => void;
-}) => Promise<AgentResult>;
-export interface SessionArgs {
-    /** A constructed provider to stream from. */
-    provider: Provider;
-    /** The tool catalogue advertised to the model and dispatched against. */
-    registry: ToolRegistry;
-    /** Resolved CLI configuration. */
-    config: CruxyConfig;
-    /** Ambient capabilities handed to each tool. */
-    ctx: ToolContext;
-    /** Git context (branch + dirty), loaded at startup, for the system prompt. */
-    git?: {
-        branch: string;
-        dirty: boolean;
-    } | null;
-    /** Project instructions (e.g. CRUXY.md) folded into every turn's system prompt. */
-    projectInstructions?: string | null;
-    /**
-     * Persistent memory (C.29): the pre-rendered recall block, injected into every
-     * turn's system prompt as reference data. Built once at session start (user
-     * memory + trusted project memory); null when memory is off or empty. Fixed
-     * for the session — it does not re-read mid-session.
-     */
-    recalledMemory?: string | null;
-    /** Start in plan mode (C.31). Toggleable at runtime via `setPlanMode`. */
-    planMode?: boolean;
-    /** The plan-mode turn runner; required for plan mode to actually engage. */
-    planRunner?: PlanRunner;
-    /**
-     * Lifecycle hooks (C.19). When set, `before-run` fires before each turn (a
-     * blocking failure — including an untrusted project — aborts the turn) and
-     * `after-run` fires after; the same runner is threaded into the agent loop for
-     * `before-tool`/`after-tool`/`on-file-change`.
-     */
-    hooks?: LifecycleHookRunner;
-    /**
-     * Multi-model routing (C.30). When set, main turns route on `main-turn` and
-     * context compaction on `summarize`; omitted → the provider default (unchanged).
-     */
-    router?: Router;
-    /**
-     * Usage telemetry sink (C.22): called once per `send` with that run's
-     * {@link UsageRecord} (real per-request usage, tier-attributed). The sink
-     * persists it locally — it never transmits. Omitted → no persistence.
-     */
-    onRunUsage?: (record: UsageRecord) => void;
-    /**
-     * Session-scoped background jobs (C.28): the manager the `run_in_background`
-     * tool dispatches onto. Exposed on the session so the REPL can service pending
-     * job approvals between turns and drive `/jobs`/`/logs`/`/cancel`, and so
-     * `cruxy run` can cancel every live job on session exit. Present only when
-     * `jobs.enabled`; omitted → no background jobs (unchanged behaviour).
-     */
-    jobs?: JobManager;
-}
-/**
- * Estimate the token footprint of a message list with a cheap chars/4 heuristic
- * — no tokenizer dependency. Good enough to decide *when* to compact; exact
- * counts are deferred to a later phase. Counts only textual payload (block
- * structure and role labels are negligible and ignored).
- */
-export declare function estimateTokens(messages: Message[]): number;
-/**
- * Owns the state of one multi-turn conversation: the running message history and
- * the usage accumulated across turns. Each `send` continues from the prior
- * history (tool_use/tool_result blocks included) rather than starting cold.
- *
- * This is also the home for context compaction: before each turn the running
- * history is measured and, if it crosses the configured threshold, its older
- * prefix is summarized away so the conversation stays within the model's window.
- * The system prompt lives in `runAgent`, never in `messages`, so compaction
- * cannot touch it.
- */
-export declare class Session {
-    /** The full running conversation, replaced with the extended history each turn. */
-    messages: Message[];
-    /** Token usage summed across every `send` (and every compaction) in this session. */
-    readonly usage: Usage;
-    /** Stable id for this session (C.22), so a run's usage record groups with the
-     * other runs of the same interactive session (`cruxy usage --session`). */
-    readonly sessionId: string;
-    /** The most recent run's usage record (C.22) — the one-shot path reads it to
-     * print the end-of-run summary. */
-    lastRun?: UsageRecord;
-    private readonly args;
-    /** Mutable so `/reload` can refresh CRUXY.md mid-session. */
-    private projectInstructions;
-    /** Mutable so `/plan` can toggle plan mode mid-session. */
-    private planMode;
-    constructor(args: SessionArgs);
-    /** The ambient tool capabilities (gate + sandbox + cwd/config). Exposed so a
-     * shell-bound custom slash command (C.19) runs through the SAME gated path. */
-    get toolContext(): ToolContext;
-    /** The background-job manager (C.28), or undefined when jobs are disabled.
-     * The REPL uses it to service paused-job approvals and drive `/jobs`; `cruxy
-     * run` uses it to cancel every live job on exit. */
-    get jobs(): JobManager | undefined;
-    /** Whether plan mode is currently on. */
-    getPlanMode(): boolean;
-    /**
-     * Toggle plan mode. Only takes effect when a `planRunner` was wired (built by
-     * the session factory); without one, plan mode stays off.
-     */
-    setPlanMode(enabled: boolean): void;
-    /**
-     * Run one user turn: append the prompt, compact if the history has grown past
-     * the threshold, drive the agent loop over the full history, adopt the
-     * extended history, and accumulate usage. Returns the turn's `AgentResult`.
-     *
-     * `renderer`, when supplied, receives assistant text deltas and tool-call
-     * progress as they stream so the caller sees the turn live (see the REPL);
-     * history is unaffected.
-     */
-    send(userPrompt: string, renderer?: StreamRenderer): Promise<AgentResult>;
-    /**
-     * Re-read project instructions (CRUXY.md / AGENTS.md) from the working
-     * directory so edits take effect without restarting. Returns the new text, or
-     * `null` if none is present. Backs the `/reload` command.
-     */
-    reloadProjectInstructions(): string | null;
-    /** Drop the conversation history but keep the session (for `/clear`). */
-    clear(): void;
-    /**
-     * Compact `this.messages` only when it has grown past threshold, adopting the
-     * result. On success logs a one-line notice and returns the number of older
-     * messages folded into the summary; otherwise returns `null` (under threshold,
-     * nothing safe to cut, or summary failed).
-     */
-    maybeCompact(onRequestUsage?: (req: RequestUsage) => void): Promise<number | null>;
-    /**
-     * The mid-loop compaction seam (build item 3) handed to {@link runAgent}: same
-     * threshold/cut/summarize path as {@link maybeCompact}, but over the loop's own
-     * running history rather than `this.messages` (the loop owns and adopts its
-     * copy). Reuses the exact machinery so no summarization logic is duplicated and
-     * the loop stays ignorant of it. Under threshold it returns the history
-     * unchanged — cheap, no model call.
-     */
-    private compactLoopHistory;
-    /**
-     * Force compaction regardless of the threshold (backs `/compact`). Returns the
-     * number of older messages summarized, or `null` if there was nothing safe to
-     * cut or the summary call failed.
-     */
-    compact(): Promise<number | null>;
-    /**
-     * Compact `messages` when its estimated footprint exceeds
-     * `compactThreshold * maxTokens`, else return it untouched. The estimate adds a
-     * fixed `reserveTokens` allowance for the system prompt and tool schemas that
-     * {@link estimateTokens} never sees (~4.5k+ tokens of real request payload), so
-     * the trigger reflects the actual request size rather than only the visible
-     * history — otherwise the loop can sit just under the visible threshold while
-     * the real request has already overrun the window. Logs a one-line notice on a
-     * successful compaction.
-     */
-    private compactIfOverThreshold;
-    /**
-     * Find a clean cut, summarize the older prefix into a synthetic user/assistant
-     * pair, and splice it in front of the kept-recent messages. Best-effort: a
-     * failed summary call leaves the history untouched and reports `compacted:
-     * null` (fail open — losing compaction is degraded, not unsafe). Pure with
-     * respect to `this.messages`: it returns the new array for the caller to adopt
-     * (the loop and the session each own their own history), and only accumulates
-     * the summary's usage into the session total.
-     */
-    private runCompaction;
-    /**
-     * Choose the boundary between the summarized prefix and the kept-recent tail.
-     *
-     * Tool-call integrity is the constraint: a `tool_use` (assistant) and its
-     * matching `tool_result` (the next user message) must never straddle the cut,
-     * or the next provider call breaks. A real user *prompt* (`role:"user"` with
-     * string content) only occurs at a completed turn boundary, where every prior
-     * tool exchange is already resolved — so the kept region must begin there. The
-     * synthetic compaction-summary user message is also string content, so a
-     * repeat compaction always finds at least the previous summary as a clean cut.
-     *
-     * Start from `length - keepRecentMessages` and walk *backwards* to the nearest
-     * such prompt: this keeps at least the recent floor and lands clean. Returns
-     * the cut index, or `null` if no safe boundary leaves a non-empty prefix
-     * (e.g. a single long in-progress turn — nothing safe to compact).
-     */
-    private findCut;
-    /**
-     * Summarize a prefix via a standalone, tool-less provider call over a rendered
-     * transcript. Throws on a stream error or empty output so callers fail open.
-     */
-    private summarize;
-}

package/dist/approval/classify.d.ts

@@ -1,18 +0,0 @@
-import type { ApproveAction } from "../tools/types.js";
-import type { ApprovalRequest } from "./types.js";
-/**
- * Classify a pending tool action into a {@link RiskTier} + a tight session
- * {@link Scope}. The cardinal rule: **anything unrecognized is `destructive`**
- * (most-restrictive) so a future/unknown action can never slip through as
- * read-only or low-risk.
- */
-export declare function classify(action: ApproveAction, cwd: string): ApprovalRequest;
-/**
- * Tokenize a command **only if** we can positively prove it is a single, simple
- * invocation (the granted program plus plain args, no shell features). Returns
- * the tokens, or `null` for anything we can't prove safe — deny-by-default. This
- * is what makes a `git` session grant refuse `git push && rm -rf /`.
- */
-export declare function commandTokens(command: string): string[] | null;
-/** Is `target` the root itself or a descendant of it? (Also true if root is a file == target.) */
-export declare function isInside(root: string, target: string): boolean;

package/dist/approval/index.d.ts

@@ -1,6 +0,0 @@
-export * from "./types.js";
-export * from "./classify.js";
-export * from "./policy.js";
-export * from "./prompt.js";
-export * from "./service.js";
-export * from "./mutex.js";

package/dist/approval/mutex.d.ts

@@ -1,45 +0,0 @@
-import type { ApprovalDecision } from "./types.js";
-import type { ApproveAction } from "../tools/types.js";
-/**
- * The approval mutex (C.33, JC-C) — the spine of the concurrent-subagent safety
- * model. Node is single-threaded, so the only hazard between parallel subagents
- * is interleaving at `await` boundaries; the one resource they genuinely contend
- * for is the interactive terminal (one prompt at a time) and the run's shared
- * checkpoint state (one snapshot/set-write at a time). Serializing every
- * *gated write* through this one lock resolves BOTH with a single mechanism:
- *
- *   • **one prompt at a time** — a child blocked awaiting the user's keypress
- *     holds the lock, so no sibling can paint a second prompt over it (the
- *     keypress is always attributable to the one displayed prompt); and
- *   • **serialized gated writes** — the checkpoint hook (snapshot + per-root set
- *     member write) runs inside the same critical section, so two concurrent
- *     writes to disjoint roots can never race on `ensureCheckpoint`'s latch or
- *     the set manifest.
- *
- * It is a plain promise-chain serializer: `runExclusive(fn)` runs `fn` only
- * after every previously-enqueued `fn` has settled. It is a LEAF lock — nothing
- * is acquired while holding it except the terminal and the filesystem, neither
- * of which waits on a subagent resource — so it cannot take part in a cycle
- * (see the deadlock argument in the C.33 design doc).
- */
-export declare class ApprovalMutex {
-    /** The settled-marker chain: always resolves (never rejects), so a rejecting
-     * critical section never wedges the queue for the next waiter. */
-    private tail;
-    /** Run `fn` in mutual exclusion with every other `runExclusive` on this mutex. */
-    runExclusive<T>(fn: () => Promise<T>): Promise<T>;
-}
-/**
- * Wrap a fully-built gate (`ApprovalService.requestApproval` behind the C.32
- * checkpoint hook) so that every gated action serializes through `mutex`.
- *
- * Every action that actually reaches the gate is a *mutation* — read-only tools
- * never call `requestApproval` at all (see the ToolContext contract), so a
- * parallel READ fan-out is already free of the lock and never stalls behind a
- * sibling's pending prompt. The `read`-tier short-circuit below is therefore
- * defensive belt-and-suspenders (mirroring `ApprovalService`'s own read check):
- * if a read-classified action ever did flow here, it would bypass the spine
- * rather than needlessly hold it. What the mutex serializes in practice is the
- * mutating set — exactly the prompt + checkpoint work that must be one-at-a-time.
- */
-export declare function serializeGate(gate: (action: ApproveAction) => Promise<ApprovalDecision>, mutex: ApprovalMutex, cwd: string): (action: ApproveAction) => Promise<ApprovalDecision>;

package/dist/approval/policy.d.ts

@@ -1,43 +0,0 @@
-import { type PromptIO } from "./prompt.js";
-import type { ApprovalDecision, ApprovalPolicy, ApprovalRequest, Scope } from "./types.js";
-/**
- * The in-memory, per-session allowlist. Grants are **scoped** (a command prefix
- * or a path subtree) and **tier-keyed** (a `mutate` grant can never cover a
- * `destructive` action), **never blanket**, and **never persisted**. A new
- * session ⇒ a new allowlist (it is owned by the per-session ApprovalService).
- */
-export declare class SessionAllowlist {
-    private grants;
-    /** Record a session grant for `request`'s scope. No-op when nothing is safe to grant. */
-    grant(request: ApprovalRequest): void;
-    /** Does an existing grant cover `request`? Requires same tier **and** scope match. */
-    allows(request: ApprovalRequest): boolean;
-    clear(): void;
-    size(): number;
-}
-/**
- * Whether `scope` covers `request`. Shell: the command must be *provably simple*
- * ({@link commandTokens}) and its program token must equal the granted token —
- * so a `git` grant never matches `git push && rm -rf /`. File: every target must
- * resolve inside the granted subtree.
- *
- * Multi-repo (C.26): `shell-prefix`, `shell-exact`, and `mcp-tool` grants are
- * additionally **bound to the root they were taken in** — the grant only covers a
- * request whose `cwd` is the same root. So "allow `git` this session" in repo A
- * never auto-approves `git` in repo B. `file-subtree` needs no such check: it is
- * an absolute path, so a different root is already a different subtree.
- */
-export declare function scopeCovers(scope: Exclude<Scope, {
-    kind: "none";
-}>, request: ApprovalRequest): boolean;
-/**
- * The default policy: consult the allowlist, otherwise prompt. On "allow this
- * session" it records the scoped grant; a rejection carries optional feedback
- * back to the agent.
- */
-export declare class InteractivePolicy implements ApprovalPolicy {
-    private readonly allowlist;
-    private readonly io;
-    constructor(allowlist: SessionAllowlist, io: PromptIO);
-    decide(request: ApprovalRequest): Promise<ApprovalDecision>;
-}